Sources Maintenance Operator¶
Preview, export, recover, safely abort, import, redact, or resume an exact paused effect through a high-consent operator boundary.
MCP name: source_maintenance_operator
Category: context
Mutates state (retry policy: manual)
Parameters¶
| Name | Type | Required | Description |
|---|---|---|---|
action |
string |
Yes | preview, status, effects, export, recover_export, abort_export, import, redact, or recover_effect. |
collision_policy |
string |
No | quarantine, remap, or reject foreign identity collisions. |
destination |
string |
No | Exact destination path for export. |
effect_id |
string |
No | Exact paused/retryable Sources effect ID for recover_effect. |
export_id |
string |
No | Durable export ID for status or recovery. |
include_content |
bool |
No | Include retained bytes in an export; defaults true. |
reason_code |
string |
No | Stable redaction reason code. |
source_path |
string |
No | Exact archive path for import. |
source_refs |
list[str] |
No | Exact SourceRef URIs; omit only to preview or export all retained Sources. |
Details¶
preview, status, and effects return content-free scope and state. Every export,
recovery, safe pre-write abort, import, and redaction requires a fresh exact high-risk approval. The
operation derives the enrolled local actor and authorization fingerprint
inside Work Buddy; callers cannot submit either. Content exports register
issued offline copies, so redaction can report that those copies may remain.
Export is a durable prepared → written → completed state machine. The archive digest and issued-copy usages are recorded before acknowledgement. Recovery verifies the exact destination bytes and never interprets an interrupted write as “not sent.” Imports retain foreign authority and quarantine collisions by default. No action silently joins the unencrypted rolling backup.
An imported archive keeps command and effect records inert. recover_effect
is the reachable operator path for one exact paused effect: its target domain,
type, payload digest, status, and error are shown in a fresh high-risk prompt,
and only that effect is reauthorized. It does not deliver the effect inside the
approval call; the ordinary domain dispatcher performs restart-safe delivery.